diff --git a/image-recipe/build-auto-installer-iso.sh b/image-recipe/build-auto-installer-iso.sh
index d3d87fd3..13443460 100755
--- a/image-recipe/build-auto-installer-iso.sh
+++ b/image-recipe/build-auto-installer-iso.sh
@@ -245,6 +245,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     openssh-server \
     nginx \
     podman \
+    uidmap \
+    slirp4netns \
+    fuse-overlayfs \
     tor \
     curl \
     git \
@@ -1094,6 +1097,14 @@ HiddenServiceDir $TOR_DIR/hidden_service_fedimint
 HiddenServicePort 8175 127.0.0.1:8175
 TORRC
 
+# Create hidden service dirs with correct ownership and permissions (700, not 750)
+# Tor refuses to start if permissions are too permissive
+for svc in archipelago bitcoin electrumx lnd btcpay mempool fedimint; do
+    mkdir -p "$TOR_DIR/hidden_service_$svc"
+    chown debian-tor:debian-tor "$TOR_DIR/hidden_service_$svc"
+    chmod 700 "$TOR_DIR/hidden_service_$svc"
+done
+
 # Prefer system Tor (installed via apt)
 if command -v tor >/dev/null 2>&1; then
     echo "$(date): Using system Tor daemon" >> "$LOG"